Modern computer systems or microprocessor based electronic devices are often interconnected by large scale communication networks. Interconnected systems, such as these, may though be vulnerable to attacks from hackers or other malicious systems. To defend or prevent such attacks, a variety of network security techniques, such as cryptographic tools, have been developed. Cryptographic tools may encrypt and decrypt messages exchanged between different computer systems or keep certain user information secret.
Cryptographic tools may also encrypt secret passwords used by users to login to a computer system. In such an application, the password may be encrypted by the use of a hash function. A hash function can be viewed as a one-way mathematical function that encrypts data. The one-way indicates that, for practical purposes, the one-way hash cannot be calculated backwards; meaning that the hash value cannot be decrypted to reveal the password in clear text again.
The hash function may thus receive the plaintext password as an input and calculates a unique hash value for that password as an output. The computer system may store only a copy of the password's hash value, such that the password's plaintext is known only to the user. In such an arrangement, when the user enters the plaintext password, the system will calculate a hash value for the entered password and compare the hash value to the stored hash value. If the two hash values match, the computer system will then accept the password and authenticate the user. Of course, to make a proper comparison, the same hash function may be applied to the entered password as was used to calculate the stored hash value.
To increase the security of the password hash function, a salt value may be used. As known in the art, the salt value is an extra variable that may be added to the password entered by the user. The salt value may, for example, be a random bit string, such as a string of characters, integers or bits generated by a random number generator. The hash function will thus compute a hash value based on an input comprising the plaintext password and the salt value. Invoking a random-salted password hash function with an identical plaintext password as the input typically results in different hash values as the output. Thus, the salt value increases the difficulty of an attacker calculating backwards the user's plaintext password from the hash value. A random salt value may thus be a counter-measure against attacks based on pre-calculated password hash values (so-called “rainbow table” attacks).
Some password authentication systems may also apply an iterative hash function. In such arrangements, the hash value itself is used as an input to the hash function in a next iteration. Thus, the hash function calculates a new hash value based on the hash value obtained in the previous iteration. Iterated hash calculation may increase the time required to calculate the final hash value and thus may be a counter-measure against certain attacks, such as brute-force or dictionary attacks.
However, the use of a salt value and iterative processing may result in a loss of the plaintext password information (e.g., entropy) in the final hash value. As such, there is a need to improve the password authentication procedures.